Reporting a vulnerability
If you think you’ve found a security issue on a Digifinch website or system, email hello@digifinch.com with “Security” in the subject line. Include the page or system affected, the steps to reproduce it and any evidence. [Consider a dedicated security@ address.]
What to expect
- We’ll acknowledge your report within [3] working days.
- We’ll keep you updated while we investigate and fix it.
- We’ll credit you once it’s fixed, if you’d like us to.
Please don’t
- Access, change or delete data that isn’t yours.
- Run tests that could disrupt services, such as denial of service.
- Use social engineering or physical attacks.
- Share the issue publicly before it’s fixed.
How we protect client sites
- Accounts are set up in the client’s name, with individual staff access.
- We use two-factor authentication wherever platforms support it.
- Platforms, themes and plugins are kept up to date on care plans.
- Backups are taken and tested where the platform allows.
security.txt
[Publish a security.txt file at /.well-known/security.txt with your security contact details.]